superset2

mirror of https://github.com/apache/superset.git synced 2026-06-11 18:49:15 +00:00

Files

Evan 4415b8a400 feat(security): terminate active sessions when an account is disabled

Disabling a user account (active=False) terminates that user's
outstanding sessions on their next request via a per-user invalidation
epoch (user_attribute.sessions_invalidated_at). Works for both
client-side cookie sessions and server-side session stores. Inert for
users that were never disabled (NULL epoch). The migration backfills the
epoch for accounts already disabled at upgrade time.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-10 11:24:30 -07:00

__init__.py

…

analytics_db_safety_tests.py

fix(database): extend URI blocklist to cover duckdb dialect (#40402 )

2026-05-30 13:26:38 -07:00

api_tests.py

test(security): regression test for session cookie after logout (#24713 ) (#40201 )

2026-05-18 07:20:51 -07:00

guest_token_security_tests.py

fix: Drill to Detail for Embedded (#39214 )

2026-04-09 17:01:48 -03:00